Glossary

Definitions as they are used on this site. Threat intelligence has an unusually unstable vocabulary — several of these words mean materially different things depending on who is speaking. Where that is the case, the entry says so instead of picking a winner quietly.

Actor naming

The practice of assigning a label to a cluster of activity. Every organisation that tracks adversaries maintains its own naming scheme, and the schemes do not map cleanly onto one another: two vendors’ names may overlap partially, one may split what another merges, and public mapping tables are approximations. A name identifies a body of analysis, not a group of people, and treating the two as equivalent is the most common error in the field.

APT

Originally a description of an adversary category — well-resourced, persistent, operating to an external objective. Now used so loosely that it frequently means nothing more than “an intrusion we considered serious”. If precision is required, describe the capability and the persistence observed rather than reaching for the acronym.

Attribution

A claim about who is responsible. Used for at least four different assertions with radically different evidentiary requirements: that this is the same activity as before, that this is a known toolset, that this is a specific organisation, and that this is a state acting deliberately. Ambiguity between these is the source of most attribution disputes.

Campaign

A set of related intrusion activity, grouped by shared objective, timing, targeting or tradecraft. There is no agreed threshold for what makes activity one campaign rather than two, so campaign boundaries are an analytic choice rather than an observed fact.

Cluster

A set of activity grouped by shared observables without any claim about who is behind it. Deliberately weaker than an actor name, and often the most defensible unit of analysis available to a defender working from internal data.

Command and control

The channel through which an operator directs compromised systems and retrieves data. Frequently abbreviated to C2. The channel’s design — protocol, timing, fallback behaviour — is often more durable as a detection target than any of the addresses it happens to use.

Confidence language

Standardised wording that states how strongly an assessment is held: low, moderate, high. Useful only when paired with the reason for the level and a statement of what evidence would change it. Confidence attached to an assessment without those two things is decoration.

Diamond model

An analytic frame that describes an intrusion event in terms of four linked features: adversary, capability, infrastructure and victim. Its practical value is the pivoting it makes explicit — from any one feature you can ask what else connects through the others.

Dwell time

The interval between an intrusion beginning and its discovery. Definitions vary in both endpoints: some measure to first detection, some to confirmed identification, some to containment, and the “start” may be first access or first malicious action. Comparisons of dwell time figures across sources are therefore usually comparing different quantities.

Exposure

What of yours is reachable and by whom. Broader than vulnerability, since a service can be fully patched and still be exposed in a way that matters. Also used in a second, unrelated sense — an organisation’s susceptibility to a given threat category — which is worth disambiguating when the word appears.

Hunting

Searching telemetry for adversary activity in the absence of an alert, driven by a hypothesis. Frequently misapplied to two other activities: running queries for known indicators, which is matching rather than hunting, and browsing dashboards, which is neither. The distinguishing feature is a stated hypothesis that the search can disprove.

Indicator of attack

An observable characteristic of adversary behaviour rather than of a specific artefact — a sequence of actions, a relationship between events. The term is used inconsistently, and in some vendor material it means nothing more than “an indicator we would like to sound more sophisticated”. Where it is used meaningfully, the contrast with the entry below is behaviour versus artefact.

Indicator of compromise

An atomic observable associated with known malicious activity: a hash, an address, a domain, a certificate fingerprint. Cheap to distribute and cheap for an adversary to invalidate. Answers the question “have I seen this”, which is only useful if you retain enough telemetry to look.

Initial access

The step by which an adversary first obtains a foothold. A specialised market exists for it, meaning the party that gains access is frequently not the party that exploits it — a division of labour that breaks the assumption that an intrusion has a single coherent author.

Intelligence requirement

A question the organisation needs answered, written down, with a named consumer who will act on the answer. Requirements are what distinguish an intelligence function from a subscription; collection and analysis exist to serve them. Often called priority intelligence requirements, borrowing military usage.

Kill chain

A model describing an intrusion as an ordered sequence of stages from reconnaissance through to action on objectives. Its usefulness is in showing that a defender can intervene at multiple points; its limitation is that real intrusions loop, skip stages and run stages in parallel, so the linearity is a teaching device rather than a description.

Living off the land

Conducting an intrusion using software already present on the target — administrative tooling, scripting interpreters, built-in utilities. Removes the adversary’s tooling cost and removes the defender’s easiest detection surface at the same time, which is why it is the default in competent operations.

Observable

Something measured or recorded — a connection, a process execution, a registration record. Distinct from an indicator, which is an observable that has been judged to carry meaning. Conflating the two is how raw data ends up in block lists.

Pyramid of pain

A ranking of observable types by how much it costs an adversary to change them, from hashes at the cheap base to tools and behaviours at the expensive top. The model’s argument is that detection built on the cheap end is discarded for free, which is why it is popular in principle and unpopular in implementation.

Reconnaissance

Adversary activity aimed at understanding a target before acting against it. Much of it happens against public sources and never touches the target’s systems, which means the defender’s visibility of this phase is usually near zero and estimates of “when it started” are consequently unreliable.

Risk

A statement about a possible future loss: a threat acting on a weakness to produce a consequence, with some likelihood. The only one of risk, threat and vulnerability that can be weighed against a cost. Frequently used as a synonym for the other two, which is where a great deal of confusion begins.

Targeting

Whom an adversary chooses to act against, and on what basis. Distinct from capability: an adversary can be extremely capable and pose no risk to you if their targeting has no intersection with what you are. Relevance filtering for intelligence is fundamentally a targeting question.

Threat

A party with capability and intent to cause harm, or an event with the potential to. Exists outside your boundary and cannot be eliminated by anything you do to your own systems — only made more expensive, less rewarding or more quickly noticed. Widely and wrongly used to mean “vulnerability”.

Threat model

A structured understanding of what could go wrong with a specific system, and what has been decided about it. In practice the word denotes two different artefacts: the process of analysis, and the document it produces. The process retains value; the document ages.

Time to detect

The interval between an event occurring and a defender becoming aware of it. Suffers the same definitional instability as dwell time, and is additionally sensitive to what counts as “an event” — a metric that improves when logging coverage shrinks is measuring the wrong thing.

TTPs

Tactics, techniques and procedures: the layered description of how an adversary operates, from broad objective down to specific implementation. Used inconsistently, most often as a vague synonym for “behaviour”. The three layers differ in how expensive they are to change, which is the reason for separating them in the first place.

Trust boundary

A line in a system across which the assumptions change — where data or a request moves from a context you control to one you do not, or vice versa. The primary unit of analysis in threat modelling, and the thing most component diagrams fail to show.

Victimology

The pattern in who an adversary has acted against: sector, geography, size, function. One of the more reliable ways to assess whether a body of reported activity has any bearing on you, and one of the least frequently checked.

Watering hole

Compromising a resource the intended targets already visit, and waiting, rather than approaching the targets directly. Notable for inverting the usual detection assumption: the malicious activity arrives from a site with an established reputation and a legitimate history.